3 Answers
3

Instead, store them in a configuration file (outside of the web root), and make sure the configuration file is not publicly accessible. The reason is that you normally don't want to keep your passwords checked into the source code repository or exposed to everyone who can view files in your web root.

There is an additional risk with storing passwords in a .php file within your webroot, which is a bit obscure but can be easily avoided by placing the file outside of your web root. Consider: if you are editing connection.php using a text editor, and your connection drops while you are editing it, your editor will automatically save a copy of the connection.php file in some backup file: e.g., connection.php~ (in the same directory). Now the backup file has a different extension, so if someone tries to fetch that file, the Apache server will happily serve up a copy of the file in plaintext, revealing your database password. See 1% of CMS-Powered Sites Expose Their Database Passwords for details.

+1 I like this answer the most. But I need to note that places outside of web root are still accessible on websites with local file inclusion vulnerabilities. Well the hacker would still need to guess the location.
–
SinistraDApr 2 '12 at 3:02

The problems comes if you have an php code that do possible the download of files on your server e.g'download.php?=index.php' .. if you check the google, you will see that this problem exists many sites with this vulnerability.